Enterprise applications: Microsoft Graph Command Line tools, How to restrict connection to Microsoft Graph and grant access to specific users

Question

Hello team,

I am trying to grant access to specific users to Microsoft Graph.

the objective is to block public access in our tenant to Microsoft Graph.

I tried using conditional access, however, in the apps to select, it doesn't show Microsoft graphs.

then, I found the option to block users' sign-in in enterprise application/Microsoft Graph Command Line tools. However, I believe this will block all the Microsoft Graph.

do you know how I can allow access to Microsoft Graph to specific users?

Answer 1

Hi @Sergio Londono ,

Thanks for reaching out.

In the Enterprise application, "Enabled for users to sign in?" property to No will not allow any users to sign into your application, even if they're assigned to it. Tokens aren't issued for the application in this scenario.

If you want to restrict users/groups to access your application, then you can use "Assignment required" setting which allow you to further lock down access to the application and let only specified users and applications obtain access tokens.

If this option is set to Yes, then users and other applications or services must first be assigned this application before being able to access it.

Any un-assigned users try to access the application will get below error:

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.

Answer 2

HI, here is a doc on that:

https://practical365.com/secure-internet-access-microsoft-graph-powershell-sdk/